Sophia is an AI-powered knowledge base assistant built on top of RESTHeart Cloud. It turns static documentation — PDFs, Markdown files, HTML pages, Word documents, spreadsheets, and more — into a conversational agent that answers questions accurately, citing the source documents it draws from. Under the hood it uses RAG (Retrieval-Augmented Generation) combined with large language models (Claude by Anthropic, Amazon Bedrock) to find and synthesize relevant content from your knowledge base.
May was the month Sophia grew up. Past releases were about depth and engineering polish; this one is about the product itself: a new home on its own domain, the launch of the commercial offering, a clearer mental model for users who configure it, and the operational pieces — multi-tenant administration, invite-based onboarding, legal compliance — that make Sophia something we can hand over to customers, not just operate ourselves.
A New Home at bysophia.ai
Sophia now lives at bysophia.ai. The previous addresses on sophia.restheart.com continue to work, but the new domain is where we'll grow the product from here. The two public instances we run are reachable at:
- RESTHeart documentation at bysophia.ai/agents/restheart
- RESTHeart Cloud docs at bysophia.ai/agents/cloud
The API endpoint moved alongside it to api.bysophia.ai, and so did the MCP server endpoint and the JWT issuer. The previous sophia.restheart.com addresses remain active for unauthenticated access — agents, chat, and MCP all work there — but authentication now requires bysophia.ai. The migration path is straightforward: update the base URL.
Sophia AI Is Now Commercially Available
This month we also launched the commercial offering. Sophia is no longer just a showcase on top of RESTHeart Cloud: companies can now buy it, and we have a pricing model published for both the PMI and Enterprise segments.
For small and medium businesses the monthly fee is €150 for the first agent, €100 for each additional one — infrastructure, software updates, and weekday business-hours support included. We can also assist with initial setup and document ingestion if needed. For larger organizations the RESTHeart + Sophia AI Enterprise subscription bundles one or more RESTHeart production instances with up to 5, 20, or unlimited Sophia agents, with progressively tighter SLAs on response time and a larger number of authorized contacts.
The pricing was a deliberate choice. Sophia is a knowledge product, not a per-seat SaaS: a single agent serves an entire team or audience, and the value is in how well it answers, not in how many people open it. Pricing per agent matches how customers actually think about deploying it.
"Contexts" Became "Agents"
The single most visible product change in May is also the smallest in code: we renamed the user-facing entity from Context to Agent.
Users were never building "contexts" — they were building assistants: an agent for tax law, an agent for the RESTHeart docs, an agent for an internal product team. The old name described the implementation (a grouping of prompt, scope, and options); the new one describes the intent. Every URL, every label in the admin panel, every reference in the docs now talks about agents.
The MCP tools got the same treatment. The redundant sophia_ prefix is gone (sophia_search is now just search), and the two interactive-artifact tools have been renamed from render_input / render_output to ask and show — names that describe what the agent is doing, not how it does it. Models pick the right tool more reliably when the name carries the intent.
Multi-Tenant Administration
Sophia now supports multiple tenants in a single deployment. Alongside the existing global admin, there is a new tenant-admin role: same administrative capabilities — agents, knowledge, users, tokens, chat history — but scoped to a single tenant's data. Tenants don't see each other.
This was the missing piece to offer Sophia as a managed service. Each customer can now self-administer their own agents, invite their own users, and inspect their own costs, while we — as platform operators — retain a global view. The isolation is implemented entirely on RESTHeart's native readFilter / writeFilter ACL rules, with the tenant injected from the user's JWT.
User Invitation, Password Reset, and Profile Page
User onboarding has been completely rebuilt around a pattern that's been proven on RESTHeart Cloud. Admins no longer set a user's password out of band: they send an invite, the user receives an email with a single-use token, picks their own password, and accepts the terms of service in a single step. The same mechanism powers the self-service password reset flow. Auto-registration remains disabled by design — Sophia is invite-only.
Around this flow we added the protections you'd expect: server-side password strength enforcement, brute-force protection on login, rate-limited password reset requests, and the ability for an admin to resend a pending invite without recreating the user. Emails go through Ermes, the same SMTP wrapper RESTHeart Cloud has been using in production.
To close the loop on the user side, every authenticated user — regardless of role — now has a profile page at /profile: a single place to see who they're logged in as, change their password, log out, and check which agents they have access to. Small thing, but until last month it didn't exist.
Legal Compliance and Consent Tracking
With the commercial launch we needed real Terms of Service and a real Privacy Policy. The policies themselves are now hosted on restheart.com (shared infrastructure with RESTHeart Cloud) at versioned, immutable URLs like /legal/terms/sophia/1.0/. Sophia stores nothing of the document content — only the consent record: which versioned URL the user accepted, when, and from which IP.
A new server-side interceptor blocks any request from a user whose accepted policy version is outdated, after a major policy change. Users hit a re-acceptance screen, agree, and resume — no support intervention needed.
Cheaper Turns with Model Profiles
April's release saved a lot through prompt caching and the search preamble. May goes further with a new mechanism: model profiles that assign different models to different phases of the agent loop.
A single turn calls the LLM up to six times — planning, the main reasoning loop, synthesis, and the terminal tool calls that save context or render an artifact. The main loop benefits enormously from prompt caching and is irreplaceable. But the terminal calls — context_save and ask — together account for roughly 73% of the input cost of a typical turn, and they don't reuse any prefix downstream. There's no good reason to run them on a premium model.
The new economy profile keeps the main loop and planning on the agent's chosen primary model (e.g. Claude Sonnet 4.6) and routes the terminal phases to a cheap, capable fallback like Nova Lite. On real telemetry this cuts input cost on a typical turn by 60–70% with no measurable regression in answer quality. An ultra-economy profile is also available for high-traffic agents that can tolerate a tiny accuracy hit on planning, and the per-phase token usage is now tracked separately so administrators can see exactly where the savings come from.
Self-Introspection for the Agent
Two new tools — interactions and interaction — let the agent look back at its own chat. The first returns a lightweight manifest of all previous interactions in the current conversation; the second drills into a specific one and returns its full step trace, including the HTML artifacts the agent produced earlier.
This sounds technical, but the user-visible effect is concrete: the agent can now reference an artifact it generated three turns ago instead of regenerating it from scratch, and it can correctly answer "what did you tell me about X earlier?" without forcing the entire transcript back into context. The tools are exposed only inside Sophia's own loop, not on MCP — Claude Desktop and other MCP clients are already in charge of their own history.
Looking Ahead
The next month is about scaling the commercial side: onboarding the first paying tenants, polishing the public home page, and finishing the document-injection re-engineering that should further cut cost on agents with very large knowledge bases. The product foundation is in place — May was the inflection point.
Ready to Build Something Great?
Focus on what makes your app unique. Your backend is ready in minutes. Start with our free tier - no credit card required.